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What is claimed is: 



Claims 



1. A method comprising the steps of: 



generating a software agent; 



splitting the software agent into a code unit and a data unit; 



forwarding the data unit to the destination host. 



2. The method of claim 1, further comprising the steps of authenticating the 
destination host, yielding authentication results, and integrating the 
authentication results into the software agent. 

3. The method of claim 1, wherein the data unit is non-executable. 

4. The method of claim 1, further comprising the step of combining the data unit 
with a watermark prior to forwarding the data unit to the destination host. 

5. The method of claim 1, further comprising the step of encrypting the data unit 
prior to forwarding the data unit to the destination host. 

6. A computer-readable signal bearing medium having computer readable 
program code that performs the steps of claim 1. 
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7. A method comprising the steps of: 
receiving a data unit from an originating host; 
verifying the data unit; 

combining the data unit with a code unit, forming a software agent; 
executing the software agent. 

8. The method of claim 7, further comprising the step of authenticating the 
originating host, yielding authentication results. 

9. The method of claim 7, wherein the step of verifying comprises the step of 
checking that the authentication results match authentication results sent with 
the data unit. 

10. The method of claim 7, further comprising the step of obtaining the code 
unit from an external source. 



11 The method of claim 10, further comprising the step of determining a level of 
risk acceptable for the code unit and selecting the external source based on the 
level of risk. 
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12. The method of claim 10, further comprising the step of authenticating the 
external source prior to accepting the code unit. 

13. The method of claim 7, further comprising the step of forwarding results of 
the executing step to the originating host. 

14. The method of claim 7, further comprising the step of decrypting the data 
unit. 

15. The method of claim 7, further comprising the step of removing a 
watermark from the data unit. 

16. The method of claim 7, further comprising the step of prohibiting a code unit 
of the originating host from being executed by the destination host. 

17. The method of claim 7, further comprising the step of rejecting the data unit 
and inhibiting the combining and executing steps. 

18. A computer-readable signal bearing medium having computer readable 
program code that performs the steps of claim 7. 
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19. A method comprising the steps of: 

splitting, by an originating host, a software agent into a code unit and a data 
unit; 

forwarding the data unit to a destination host; 

receiving, by the destination host, the data unit from the originating host; 

combining, by the destination host, the data unit with a code unit associated 
with the data unit, forming a destination agent, wherein the code unit is not 
sourced by the originating host; 



executing the destination agent. 
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20. The method of claim 19, further comprising the step of integrating, by the 
originating host, authentication results into the software agent prior to the 
splitting step. 

21. The method of claim 19, wherein the data unit is non-executable. 

22. The method of claim 19, further comprising the step of verifying, by the 
destination host, the data unit. 

23. The method of claim 22, wherein the step of verifying comprises the step of 
checking that the authentication results match authentication results sent with 
the data unit. 

24. The method of claim 19, further comprising the step of obtaining, by the 
destination host, the code unit associated with the data unit from an external 
source. 

25. The method of claim 24, further comprising the step of determining a level 
of risk acceptable for the code unit and selecting the external source based on 
the level of risk. 

26. The method of claim 24, further comprising the step of authenticating the 
external source prior to accepting the code unit associated with the data unit. 
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27. The method of claim 19, further comprising the steps of combining the data 
unit with a watermark prior to forwarding the data unit to the destination host 
and removing, by the destination host, the watermark from the data unit prior 
to the combining step. 

28. The method of claim 19, further comprising the steps of encrypting the data 
unit prior to forwarding the data unit to the destination host and decrypting, by 
the destination host, the data unit prior to the combining step. 

29. The method of claim 19, further comprising the step of prohibiting the code 
unit of the originating host from being executed by the destination host. 

30. The method of claim 19, further comprising the step of forwarding results of 
the executing step to the originating host. 

31. The method of claim 19, further comprising the step of rejecting the data 
unit and inhibiting the combining and executing steps. 

32. A computer-readable signal bearing medium having computer readable 
program code that performs the steps of claim 19. 
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33. A system comprising: 

an originating host, arranged and constructed to split a software agent into a 
code unit and a data unit and forward the data unit to a destination host; 

a destination host, arranged and constructed to receive the data unit, to 
combine the data unit with a code unit associated with the data unit, thereby 
forming a destination agent, wherein the code unit is not sourced by the 
originating host. 



34. The system of claim 33, wherein the originating host and destination host 
are further arranged and constructed to complete an authentication process, 
yielding authentication results that are integrated into the software agent prior 
to the splitting step. 

35. The system of claim 34, wherein the destination host is further arranged and 
constructed to verify the data unit by checking that the authentication results 
match authentication results sent with the data unit. 

36. The system of claim 33, wherein the data unit is non-executable. 

37. The system of claim 33, wherein the destination host is further arranged and 
constructed to obtain the code unit associated with the data unit from an 
external source. 
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38. The system of claim 37, wherein the destination host is further arranged and 
constructed to determine a level of risk acceptable for the code unit and select 
the external source based on the level of risk. 

39. The system of claim 33, wherein the originating host is further arranged and 
constructed to combine the data unit with a watermark prior to forwarding the 
data unit to the destination host, and wherein the destination host is further 
arranged and constructed to remove the watermark from the data unit prior to 
the combining step. 

40. The system of claim 33, wherein the originating host is further arranged and 
constructed to encrypt the data unit prior to forwarding the data unit to the 
destination host, and wherein the destination host is further arranged and 
constructed to decrypt the data unit prior to the combining step. 

41. The system of claim 33, wherein the destination host is further arranged and 
constructed to prohibit the code unit of the originating host from being executed 
by the destination host. 



